I am trying to find out a password for an area of a website that uses the GET
method to authenticate correct credentials. The page is an .aspx
but I'm not sure if that makes any effective difference.
The facts:
- I already know the username.
- There is no protection against bots - Ex: there is no
CAPTCHA
protection. There is nothing in place to validate that a human is making the login attempt. - Retries are unlimited. The page won't kick you off or force a cool down period for subsequent failed attempts.
This is not a homework question or project, and more importantly, obtaining and using the password (if found) does not violate any laws.
I am just not familiar with using brute force programs to crack the password. All I know about brute force password crackers is that they systematically attempt to login using either a provided dictionary txt file of passwords or an auto-generated list.
I've tried Brutus and one other program on a Mac that I forget the name of. Both of them have not given me anything useful and seemed to have not made a single attempt either. I don't know if brute force is the way to go or if I'm using out-dated programs, but whatever the case, does anyone know how I could crack the password?
As I mentioned before, there is no legal concerns here. I am merely trying to prove a point to someone who thinks that developing his own login script is better than implementing a package that has already covered these "hacking" prevention issues.
If anyone believes that this question is inappropriate or unacceptable for superuser.com, please migrate it to another stack exchange family member. If it is totally out of line, I'm sorry, vote to close or delete it.
Thanks for any info